The Journal Online

Introduction The Army tactical network(s) currently comprise multiple, individually federated, transport mechanisms. Almost all warfighting functions, in addition to other specialized services (e.g. medical), maintain a dedicated network communication infrastructure. While this does provide some redundancy[i], it also impedes collaboration and data sharing, as well as greatly increases complexity and Cost, Size, Weight and Power (SWaP) requirements across all tactical echelons. The U.S. Army Cyber Center of Excellence has recently introduced a plan to converge these Command Post (CP) network architectures, promoting the concept of a single transport layer as a means to increase efficiency and enable the sharing of data across all mission functions. Achieving this degree of integration has numerous challenges. This article will focus on just one – critical information delivery assurance. Given that within this network model, all data must share a single finite capacity communication transport layer, how do we ensure that critical information is provided some assurance of guaranteed delivery and responsiveness? To achieve this, we make the case that a converged tactical network must support a comprehensive Quality of Service (QoS) implementation as well as graceful degradation mechanisms. Background As related to computer networking, QoS is a means of prioritizing amongst various data flows such that some degree of assured service can be maintained. Simply put, QoS can be thought of as a contract between the application (user) and the network, ensuring some agreed-upon minimum level of service. QoS is predicated on the fact that not all data streams are as susceptible to high latency or bit error rate conditions as others, or that not all communication streams are of equivalent...

Abstract Education will be the cornerstone for our nation’s success in cyberspace. The military has made efforts towards building the force necessary to defend its borders within cyberspace. The United States (US), however, will need to invest in its youth to better prepare for the future. This article focuses on current efforts to prepare for cyber warfare through the education system, community programs, and military training. With a better understanding of the current efforts, organizations can strengthen programs or focus on areas necessary to further US capabilities in cyberspace. Introduction Over the course of the last century, warfare has made giant leaps in terms of battle ground in which war is fought. No longer are wars fought solely on ground, air, or sea, but in space, and now cyberspace. Due to this change in terrain, Soldiers must be smarter than they have ever been, and eager to not only train physically, but mentally. The need to educate Soldiers has become crucial to future military success, and that need reaches beyond the services to grade school, in order to develop the fighting force the US requires. The question becomes, what is the US doing to better prepare young people to inherit the cyberspace battlefield? To answer this question, the military is making changes to its current structure as well as looking to other agencies and organizations to fill military requirements. Education “We know that the nation that out-educates today will out-compete us tomorrow. And I don’t intend to have us out-educated.”[1] – Barack Obama, President of the United States of America. In the aftermath of 9/11, the US government...

Due to a recent increase in popularity, Darknet hacker marketplaces and forums now provide a rich source of cyber threat intelligence for security analysts. This paper covers background information on Darknet hacker communities and their value to the cybersecurity community before detailing an operational data-collection system that is currently gathering over 300 threat warnings per week, with a precision of around 90% (Nunes 2016). Additionally, we introduce a game theoretic framework designed to leverage the exploit data mined from the Darknet to provide system-specific policy recommendations. For the framework, we provide complexity results, provably near-optimal approximation algorithms, and evaluations on a dataset of real-world exploits. Download the full...

Blogs

Conducting cyber warfare is cheap and easy.[1] It affords anyone from individual hackers to nation-state actors the ability to wage destructive acts against the United States.[2] In 2009, the Secretary of Defense directed the Commander of U.S. Strategic Command to establish a sub-unified command, U.S. Cyber Command (USCYBERCOM), to prepare the Department of Defense (DoD) for the integration of offensive and defensive cyberspace operations.[3] Due to the constant rate of change in cyberspace, USCYBERCOM has experienced challenges integrating joint force cyber components. A quick examination of the US cyber force organizational chart demonstrates how complex the relationships are between service components and outside agencies. These organizational intricacies have led Admiral Michael Rogers, National Security Agency (NSA) Director and Commander of USCYBERCOM, to ask “is cyber so different, so specialized, so unique, so not well understood that it requires a very centralized, focused, unique construct to how we generate capacity and knowledge?”[4] While still heavily debated, many US government officials believe the existing organizational structure best meets current DoD requirements. However, there is an increasing necessity to transform the joint cyber construct into a stand-alone military service branch or similar entity that is separate from, yet integrated into the other military service branches. This necessity is based on cyberspace operations occurring in a separate operational domain, requiring a different organizational composition than traditional service branches, and hampered by the current joint cyber construct. The most compelling reason for creating a separate, standalone cyber service is its distinct “global domain within the information environment consisting of the interdependent network of information technology infrastructures and resident data, including the Internet, telecommunication networks,...

“Probable impossibilities are to be preferred to improbable possibilities” It is immensely convenient to claim that a Federal election can be hacked; however, the reality of hacking such an election is far more difficult than one might realize. The level of complexity in the US electoral process is such that to hack the election would require a combined feat of technical and social engineering requiring tens of thousands of co-conspirators operating across hundreds of jurisdictional boundaries with divergent laws and practices. Having worked in democracy development for the better part of 10 years on elections in several dozen countries, the state of American electoral security is strong because of its immensely decentralized nature. In a case where the bewildering and often arcane complexity facilitates inefficiency, it is this inefficiency that coincidentally fosters systemic resilience. It is the organizational attributes of a national election run by state and local authorities that make the United States a poor target for any malicious actor attempting to directly affect the polling places where American’s cast their ballots. To understand why the United States is so resilient to malicious actors seeking to manipulate a national election requires understanding the nuances of federal, state and local roles in the execution of a national election. One of the best sources for understanding the complexities of the American voting process was produced by a 2014 Presidential Commission. The commission deconstructs its recommendations and thereby provides insight into the electoral procedures of states by examining issues about voter registration, access to polling locations, the management of polling places, and the technology of voting itself.[i] It should be noted...

At the recent Joint Service Academy (JSA) Cyber Security Summit at West Point (20-21 April, 2016), the word “cyber” was used in multiple different facets. As a noun, cyberspace is the “Domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data…” [COL11]. This is perhaps the broadest definition possible, proposed as the Cyberspace Operations Lexicon by the Joint Chiefs of Staff. While the ambiguity with the meaning of the proper noun “Cyber” provides a difficult framework to focus meaningful actions, our use of the words “Cyber”, “Digital” and their like as adjectives serves only to create artificial divisions among researchers, practitioners, and decision-makers in the area. The term “Cyber Security” is of course ubiquitous, being the focus of the JSA Cyber Security Summit and one of the main foci of the Army Cyber Institute (ACI) at West Point; that is unavoidable. Cyber Security can be many things: at the JSA Summit it was identified as the agglomeration of practicing good hardware and software manufacturing and implementation, sourcing trusted components (again, from both a hardware and software side) and providing training and education for workers to avoid naively poking holes in those standards [CON16]. The term operational security (OPSEC) is used to describe our behaviors while conducting the mission. For those whose jobs have security considerations, OPSEC refers to not discussing their work in public places, even in an unclassified way. The phrase “Digital OPSEC” or even “Cyber OPSEC” is frequently used to discuss our behaviors on the internet, such as not connecting to public WiFi, using discretion with location services on our...

Network Science Center

The issue. DoD has been trying to establish its plans, structures, processes, and systems to deal with its cybersecurity and operational issues for several years. These efforts have slowly evolved as DoD has clarified and understood its cyber mission. Given the latest proclamation of the cyber roles assigned to government agencies (in the Presidential Policy Directive 41), it is probably time to put together more definitive plans for the DoD cyber forces and the cyber duties associated with all units, service members, and DoD employees. Another recent document that helps DoD sort out its cyber roles comes from the Joint Operating Environment 2035 (JOE2035), subtitled The Joint Force in a Contested and Disordered World, published in 14 July 2016. Essentially, the President’s document assigns DoD to take care of DoD-related contested military cyber issues. The JOE2035 predicts there will be plenty to do by the cyber forces, and identifies a high-probability, almost continuous, context for future conflict in cyberspace by outlining the struggle to define and protect sovereignty in cyberspace for our military. The cyber domain is a growth area with the specter of continuous, sometimes intense, conflict for a long time. With the US depending heavily on the interdependent networks of information technology (Internet, telecommunications networks, computer systems, embedded processors and controllers) and the data, information, and knowledge that is stored and flows through and between these systems, the cyber domain is the place where a high-stakes competition has, is and will be taking place. DoD is concerned about: Growth of state- and non-state-sponsored cyber forces and capabilities. These organizations will have more advanced cyber warfare capabilities....

The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography Simon Singh New York: Random House, 1999, 432 pp. ISBN 978-0-307-78784-2 The Code Book is about the mathematics and science of codes and ciphers throughout history. Singh specifically lists two purposes for this book. The first is to show the evolution of codes and ciphers, and the second is to demonstrate their relevance in today’s society. Throughout the eight chapters, he discusses the elements of complex ciphers and simplifies the mathematical details for a general audience. He enthusiastically presents stories surrounding ciphers such as who created them, who sought to break them, and if and how the codebreakers were successful. We, as student and instructor in a course entitled Networks for Cyber Operations, used this book as one of our texts in the Spring semester of 2016. To illustrate his first point, Singh shares stories about well-known ciphers such as those involving Mary Queen of Scots, the Beale Papers, and the Enigma. He uses Mary Queen of Scots to show the evolution of secret writing and the development of cryptography. He discusses how secret writing evolved into steganography and cryptography, how cryptography developed into transposition and substitution, and lastly, how substitution evolved into codes and ciphers. Additionally, he discusses the story behind the Beale Papers to introduce how codemakers use keys to encrypt their messages. Sharing the story of the Enigma Machine in World War II, he shows the evolution from encryption by hand to encryption by machine. Singh also reveals how codebreakers accomplished their work to demonstrate that as long as codemakers develop new...

Disclaimer

The views expressed are those of the author and do not reflect the official policy or position of West Point, the Department of the Army, the Department of Defense, or the US Government.